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(54) Controlled acceptance mall system securely enabling reuse of digital token initially 

generated for a mailplece on a subsequently prepared different mailpiece to authenticate 
payment of postage 



(57) A method and system for mail payment evi- 
dencing includes processing a collation of mail (1020) 
where the collation is one of a series of mail collations 
being created. Payment rating parameters are deter- 
mined for carrier services (1012) to be associated with 
the mail collation in process. It is determined if a previ- 
ously generated digital token (1008) associated with a 
previous mail collation which was not completed is suit- 



able for use on said mail collation in process. The previ- 
ously generated digrtaJ token is utilized for the mail 
collation (1020) in process if the previously generated 
digital token is suitable for use on said mail collation in 
process. The created mail collations may be submitted 
to a carrier service (1012) with a digitally signed state- 
ment of mailing (1018). 
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Description 

The present invention pertains to mail payment and 
evidencing systems and methods. The invention is 
applicable to an error recovery system for controlled s 
acceptance mail payment and evidencing systems. 

Various batch mailing systems employing control- 
led mail acceptance have been developed. For exam- 
ple, such a system is disclosed in European Patent 
Publication No. 0741374 for CONTROLLED ACCEPT- 10 
ANCE MAIL PAYMENT AND EVIDENCE SYSTEM and 
in European Patent Publication No. 0741375 for 
CLOSED LOOP TRANSACTION BASED MAIL 
ACCOUNTING AND PAYMENT SYSTEM WITH CAR- 
RIER PAYMENT THROUGH A THIRD PARTY INITI- 15 
ATED BY MAILING INFORMATION RELEASE. Both of 
these patent applications are assigned to Pitney Bowes 
Inc. These systems provide significant advantages in 
controlled acceptance batch mailing systems. 

Error recovery, such as funds recovery, in traditional 20 
metering for controlled acceptance mail (i.e. mail that is 
produced, finished, postaged and/or sorted by an 
inserter machine, mailing machine or mail sorter) is a 
difficult, error prone and time consuming process. Often 
spoiled or otherwise damaged mail that has become 25 
non-mailable has been imprinted with postage evi- 
dence. Non-mailability may be due to physical mutila- 
tion, incorrect contents, printing after mutilation, 
postage not printed correctly or a decision by a mailer 
not to utilize a mailpiece. In this case the postage has 30 
been paid for by subtracting the postage amount from 
the value of funds that were loaded in the meter. In 
order to recover lost postage, the mailer normally has to 
present spoiled mail together with a special report to the 
postal authority. Then the postage may be refunded, 35 
but, for some postal authorities, only at 90% or less of 
true value. In other words, the mailer frequently loses at 
least 10% of the postage value in addition to labor and 
other expenses required for postage to be refunded by 
postal authorities. 40 

It has been suggested in the above-noted Euro- 
pean Patent Publication No. 0741374 for CONTROL- 
LED ACCEPTANCE MAIL PAYMENT AND EVIDENCE 
SYSTEM that mailers from time to time desire refunds 
for spoiled mailpieces and a refund process and 45 
accounting procedure is desirably included in postage 
payment and evidencing systems and additionally, that 
the spoiled mailpieces such as mailpieces destroyed by 
the insertion equipment can be simply recreated and 
the postage evidence or digital token data stored in the so 
inserter controller memory can be reprinted. In such 
case the mail piece is recreated and the digital token 
reused. Fraudulent "salting" of the mail run is detected 
by the process of weighing the mailpieces batch upon 
acceptance and, when desired, statistical sampling of ss 
the postage evidence. 

Another method for recovery of funds for spoiled 
mailpieces suggested in the above-noted European 
Patent Publication No. 0741375 for CONTROLLED 



ACCEPTANCE MAIL PAYMENT AND EVIDENCE SYS- 
TEM involves a system where the digital token may not 
be reprinted without being accounted for by the vault 
system. In systems of this type the indicia printer, which 
prints the digital token and other information, is securely 
coupled either by physical security or by encryption 
security to the accounting vault and a mail error recov- 
ery file may be used in a system when indicias (which 
include the digital tokens) have been reprinted. 

It is an object of the present invention to provide an 
improved postage payment and evidencing system. 

It is a further object of the present invention to pro- 
vide an effective controlled acceptance process for mail 
that includes improved flexibility for the mailer in creat- 
ing mail and a high level of security for payment and evi- 
dencing of appropriate postage. 

It is yet a further objective of the present invention 
to employ a digital token system for controlled accept- 
ance mail that allows flexible preparation of mixed 
weight mail and security of carrier service payment 
funds. 

It has been discovered that controlled mail accept- 
ance systems can be enhanced by providing a capabil- 
ity for reusing digital tokens which were initially 
generated to provide evidence of postage or carrier 
service payment on mailpieces which were not mailed 
(not completed) on different mailpieces which are not 
recreations of the not completed mailpieces. 

A method for mail payment evidencing in accord- 
ance with the present invention includes processing a 
collation of mail where the collation is one of a series of 
mail collations being created. A mail collation which is 
determined to be unsuitable for mailing is not com- 
pleted. It is determined if a previously generated digital 
token associated with a previous mail collation which 
was not completed is suitable for use on said mail colla- 
tion in process. The previously generated digital token is 
utilized for the mail collation in process if the previously 
generated digital token is suitable for use on said mail 
collation in process. 

In accordance with a feature of the present invention the 
created mail collations may be submitted to a carrier 
service with a digitally signed statement of mailing. In 
accordance with another feature of the present inven- 
tion, the statement of mailing may include information 
concerning generated digital tokens which are not uti- 
lized in the series of mail completed collations. 

Reference is now made to the following figures 
wherein like reference numerals designate similar ele- 
ments in the various figures and in which: 

FIGURE 1 is a diagrammatic representation of a 
closed loop transaction based mail accounting and 
payment system according to an embodiment of 
the present invention with the capability of securely 
reusing digital tokens; 

FIGURE 2 is a diagrammatic representation of a 
batch mail generation system suitable for use with 
an embodiment of the present invention and utiliz- 
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ing an inserter based system adapted to imprint 
postal indicia; 

FIGURE 3 is a block diagram showing greater detail 
of the secure accounting device including an 
encryption engine for executing digital token trans- 
formation to generate digital tokens imprinted on 
each mailpiece and for cryptographically signing 
the statement of mailing; 

FIGURE 4 is a depiction of mailpieces created in 
accordance with an embodiment of the present 
invention based on the system shown in FIGURE 1 
and employing a digital token originally generated 
for use on a non-mailed or spoiled mailpiece; 
FIGURE 5 is a statement of mailing suitable for use 
in the present system without being linked to a dig- 
ital token error recovery file; 
FIGURE 6 is a depiction of a list of collations in 
process reflecting information which would be 
maintained within the inserter controller or the con- 
troller of any other mail preparation equipment; 
FIGURE 7 is a list of indicia available for re-use 
showing the information which would be stored in 
the inserter controller or controller of any other mail 
preparation equipment; 

FIGURE 8 is a list of completed indicias depicting 
information also stored in the memory of the 
inserter controller or any other mail preparation 
equipment; 

FIGURE 9 is a list of collations in process after 
reuse of an indicia number 2 depicting the informa- 
tion stored in the inserter controller or controller of 
other mail preparation equipment; 
FIGURE 10 is a list of indicias available for reuse 
after reuse of indicia number 2 depicting informa- 
tion stored in the inserter controller or controller of 
any other mail preparation equipment; 
FIGURE 11 is a list of collations in process after 
completion of collation number 7 depicting informa- 
tion stored in the inserter controller or controller of 
other equipment used in mail preparation; 
FIGURE 12 is a list of completed indicias after com- 
pletion of a collation number 7 depicting information 
stored in the inserter controller or controller of any 
other equipment used in mail preparation; 
FIGURE 13 is a flow chart of the inserter controller 
process helpful in an understanding of the present 
invention; and 

FIGURE 14 is a flow chart of the statement of mail 
generation process performed in the secure 
accounting device and helpful to an understanding 
of the present invention. 

As a general overview, controlled mail acceptance 
systems provide the capability for reusing, on other 
mailpieces, digital tokens produced to provide evidence 
of postage or carrier service payment on non-mailed 
(such as spoiled) mailpieces where the other mailpieces 
are not a recreation of any specific spoiled mailpiece. 
That is. the non-mailed mailpiece can be replaced with 



a different mailpiece to a different addressee. This is 
achieved without sacrificing any security in the system 
by virtue of the total weight for the batch of mailing being 
confirmed and a digital token being printed on each 

5 mailpiece evidencing proper accounting (and if desired, 
also for proper rating) for the specific mailpiece. The 
digital token allows verification of the accounting and, if 
desired, verification of the proper rating. 

Because the digital token in the present system is 

10 printed without addressee information and may be 
printed on any mailpiece for which it may qualify 
because of similar rating, no error documentation file is 
needed and the system does not employ an error docu- 
mentation file to account and reconcile the issuance of 

15 plural tokens for use on spoiled mailpieces. 

The system issues a digital token only once if the 
mailpiece is spoiled or otherwise not mailed. The digital 
token for that mailpiece along with the rating parameters 
associated with that mailpiece is stored for subsequent 

20 use on a completely different mailpi ece where the rating 
parameters are the same. The improper use of digital 
tokens on more than one mailpiece is detected by the 
use of a statement of mailing for the total weight of the 
mail batch where the total weight is reconfirmed at the 

25 mail acceptance point as well as by detecting duplicates 
on a sampling basis. 

Additionally, by using the payment system dis- 
closed in pending European Patent Publication No. 
0741375 for CLOSED LOOP TRANSACTION BASED 

30 MAILING AND ACCOUNTING AND PAYMENT SYS- 
TEM WITH CARRIER PAYMENT THROUGH A THIRD 
PARTY INITIATED BY MAILING INFORMATION 
RELEASE, where non-mailed mail such as a spoiled 
mailpiece occurs and digital tokens are stored for later 

35 use on later mailpieces having similar rating parameters 
and where such no further mailpieces exist at the com- 
pletion of the mail preparation operation, these non- 
used digital tokens may be simply deleted from the 
secure accounting device and no payment need be 

40 made for them as part of the funds transfer. As a result, 
no reconciliation need be made for these digital tokens 
and the system provides significantly enhanced func- 
tionality. 

Security of the system and benefit of the system 
45 are achieved by utilizing both the statement of mailing 
which is a verified signed statement listing all of the 
mailpieces and including the total weight for the batch of 
mail and by printing an encrypted indicia on each and 
every mailpiece. The security benefit from the state- 
so ment of mailing is that salting of mailpieces into the mail 
batch is easily detectable and the verified statement of 
mailing cannot be altered since it is digitally signed. This 
provides a first level of security with respect to the batch 
of mailing. The imprinting of the digital token on each 
55 mailpiece provides additional separate security in that 
the detection of duplicate digital indicias in a mail batch 
or anywhere depending upon the system, provides evi- 
dence of fraud which can be investigated. The existence 
of duplicate digital indicia should not occur in the nor- 
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mally operated system because the generation of the 
digital tokens is something that will not allow repeating 
of the same digital indicia as the time changes, the date 
changes, or the piece count changes, any of which may 
be included in the digital indicia and render that particu- 
lar indicia unique. However, the security of the system is 
predicated upon the fact that a legitimate indicia exists 
in single copies within the entire system. Thus, the 
detection of the indicia in more than one instance pro- 
vides evidence of improper activity by a mailer. 

It should be recognized that although the process 
will be described with reierence to an insertion machine, 
it is fully applicable to other means of mail production 
and finishing such as mailing machines and mail sort- 
ers. 

Reference is now made to FIGURE 1. A mailer 
facility 1002 includes a secure accounting device 1004 
and a mail generation and finishing system 1006. The 
mail generation and finishing system 1006 may be any 
of a large number of mailing systems which creates and 
processes mailpieces to prepare them for delivery to a 
carrier. The mail generation and finishing system 1006 
is coupled to a secure accounting device 1004 which 
will be explained in greater detail in connection with 
FIGURES 2 and 3. The secure accounting device 1004, 
for each mailpiece to be produced by the mail genera- 
tion and finishing system 1006, issues a series of digital 
tokens to be imprinted on the mailpieces. The stream of 
digital tokens being issued by the secure accounting 
device 1004 is diagramatically shown as 1008. A digital 
token is encrypted data that authenticates the value or 
other information imprinted on the mailpiece. The digital 
token may include the rating information, the payment 
value associated with a particular mailpiece and, for 
example, the serial number or other identifying data 
relating to the secure accounting device 1004. Samples 
of systems for generating and using digital tokens are 
described in U.S. Patent No. 4,757,537 for SYSTEM 
FOR DETECTING UNACCOUNTED FOR PRINTING 
IN A VALUE PRINTING SYSTEM; U.S. Patent No. 
4,831,555 for UNSECURED POSTAGE APPLYING 
SYSTEM; and, U.S. Patent No. 4,775,246 for SYSTEM 
FOR DETECTING UNACCOUNTED FOR PRINTING 
IN A VALUE PRINTING SYSTEM. Because the digital 
token incorporates encrypted data including postage 
value, altering the printed postage value in the postage 
revenue block is detectable by standard verification pro- 
cedures. Additionally, the secure accounting device 
1004 accounts for each digital token issued to the mail 
generation and finishing system for imprinting on a mail- 
piece. 

The secure accounting device 1004 further gener- 
ates and stores the statement of mailing associated with 
a batch of mail being prepared by the mail generation 
and finishing system 1006. This statement of mailing is 
electronically communicated to a remote transaction 
processing center 1010. This initiates a further trans- 
mission of the statement of mailing and authorization for 
payment to a carrier service 1012. The transmission of 



the statement of mailing is the release of mailing infor- 
mation by the mailer to a third party, here the transac- 
tion processing center, to authorize payment by the 
processing transaction center to the carrier. The pay- 

5 ment may be by the transaction processing center 1 01 0 
accessing a mailer account at a financial institution 
1014 for either direct payment by the financial institution 
to the carrier service or by being passed through the 
transaction processing center and then to the carrier 

/A service or carrier service financial institution, as for 
example, post office bank 1016. To provide a redun- 
dancy in the system and for logistics planning, the state- 
ment of mailing may additionally be transmitted directly 
by the mailer 1002 either in electronic and/or in printed 

15 form (such as a printed statement of mailing 1018) to 
the carrier service 1 01 2. The statement of mailing trans- 
mission to the carrier service provides a verification, 
independent of the verification of the transmission 
occurring via the transaction processing center 1010. 

20 After the statement of mailing has been electroni- 
cally transmitted by the secure accounting device 1004 
to the transaction processing center 1010, the batch of 
mail 1020 associated with the transaction is physically 
transmitted to the carrier service 1012. The carrier serv- 

25 ice then may perform the various control acceptance 
procedures associated with the carrier service internal 
processes, as for example, weighing the batch of mail 
and/or randomly sampling various pieces of mail and 
verifying them against the statement of mailing. 

30 It should be expressly noted that a number of the 
digital tokens 1008 issued by the secure accounting 
device 1004 to the mail generation and finishing system 
1006 may be for a mailpiece that becomes non-mailable 
during processing; however, the digital token, as will be 

35 more fully explained hereinafter, may be reused on an 
alternate completely different mailpiece out of sequence 
in the mail generation process. This different mailpiece 
may be to a completely different addressee and may 
include totally different message or other contents. 

40 The system provides a closed loop transaction in 
that upon receipt of the statement of mailing by the car- 
rier 1012 and processing of the batch of mail 1020, the 
carrier communicates either directly or via the transac- 
tion processing center 1010 to the mailer 1002 indicat- 

45 ing acceptance and processing of the batch of mail 
1020. 

Various implementations are possible regarding the 
operation of the secure accounting device 1004. For 
example, the secure accounting device 1004 will not 

so release the statement of mailing for utilization by the 
mail processing system until it is initially transmitted 
electronically to the transaction processing center 1010 
and approved by the transaction processing center 
based on funds availability in the mailer's account 1014. 

55 This provides enhanced security assurance of ultimate 
payment to the carrier, here shown as a post office 
operation. 

The process of postage payment is entirely control- 
led by the mailer 1002. After the mail generation and fin- 
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ishing system has completed preparation of the batch of 
mail 1020, the mailer, at the time of the mailer's choos- 
ing, initiates a communication between the secure 
accounting device 1004 and the transaction processing 
center 1010. This communication involves transmission 5 
of information related to the statement of mailing to be 
prepared once authorization is received from the trans- 
action processing center concerning funds availability. 
At the time the transaction processing center 1010 pro- 
vides the authorization to the secure accounting device w 
1004, the transaction processing center 1010 also 
transfers appropriate funds to the carrier service 1012. 
Unlike secure accounting devices that store carrier pay- 
ment value, such as electronic postage meters and 
other such postage payment devices that store funds, 15 
the secure accounting device 1004 does not store pre- 
paid carrier value for use in printing evidence of pay- 
ment for carrier services. It should be expressly 
recognized, however, that the present system involving 
the use of digital tokens initially intended for a mailpiece 20 
that has been spoiled or not generated, for any reason, 
is equally usable in various other systems where, like 
electronic postage meters, funds are stored in a secure 
accounting device. 

The communications system shown in FIGURE 1 25 
facilitates a bi-directional communications. This com- 
munication is particularly useful for providing confirma- 
tion to the mailer 1002 as to the provision of certain 
requested services. Examples of such services are reg- 
istered or certified mail services for particular mail- 30 
pieces, insurance payment for particular mail and 
special delivery for particular mailpieces. All of these 
and other forms of special services, can be confirmed 
by the carrier service 1012 through the transaction 
processing center 1 0 1 0 to the secure accounting device 35 
1004 to securely store and provide the information to 
the mailer. Since the communications and storage of 
information is secure, the receipt of information pro- 
vides proof of delivery, or deposit and/or other services. 

Rating tables and rating information can be com- 40 
municated from the carrier service 1012 through the 
transaction processing center 1010 to the secure 
accounting device 1004. In this manner, the secure 
accounting device 1004 may be continually updated 
with the most current and appropriate rating tables for 45 
the various mailing activities desired to be implemented 
by the mailer 1002. It provides an opportunity for the 
carrier service 1012 to dynamically update the various 
rating tables and to provide temporary discounts for var- 
ious services, such as mailing occurring at a particular so 
time, to a particular facility or in a particular manner. 
This can be utilized to optimize traffic through the carrier 
system by means of various rating incentives. 

Reference is now made to FIGURE 2. An inserter 
system 2002 includes a computer controller 2004 for 55 
the inserter. The controller 2004 controls both a plurality 
of feeder modules shown generally at 2006, an enve- 
lope insertion module 2008 and a printer 2020. The 
controller 2004 is further connected to a control docu- 



ment feeder module 2012 and to a secure accounting 
device 2014 by means of a bi-directional communica- 
tions channel 2016. The secure accounting device 2014 
is operatively connected to a non-secure report printer 
2018 utilized to print a statement of mailing and to a 
printer 2020 for imprinting the indicia, including the dig- 
ital tokens on each mailpiece of the batch of mail. The 
printer 2020 is not securely coupled to the inserter con- 
troller 2004. Any printer may be utilized at any appropri- 
ate point in the process to imprint the encrypted indicia 
including the digital token on the mailpiece. For exam- 
ple, if the encrypted indicia and digital token are 
imprinted on the mail contents, they may be employed 
with a window envelope or they could be imprinted on 
the envelope prior to insertion of the mailpiece contents. 

In operation, under control of the inserter controller 
2004, control documents are fed from the control docu- 
ment feeder module 2012 onto the inserter transport 
(not shown). The control document determines the 
operation of the various feeder modules 2006 to selec- 
tively feed inserts onto the transport to be assembled 
into a collation and inserted into an envelope fed from 
the envelope feeder 2008. An assembled mailpiece, not 
shown, when it reaches printer 2020 has an address 
imprinted on the envelope such as for non-windowed 
mail. The assembled mailpieces now may be imprinted 
with an indicia by the printer 2020. As previously noted, 
the indicia is an encrypted indicia which includes a dig- 
ital token provided by the secure accounting device 
2014. The printer 2020 may be a general purpose 
printer suitable for use with an inserter machine and 
may print other necessary and optional information, 
such as delivery point postal bar code, advertising 
material, slogans, and the like. Many other organiza- 
tions for insertion systems or other mail preparation sys- 
tems can be utilized with the present invention. For 
example, rather than employing insertion equipment, 
mailing machines may be utilized as part of the mail 
preparation process. Further examples include that the 
feeder modules 2006 can be directly controlled by the 
inserter controller 2004 or the insertion process can be 
controlled via magnetic media such as floppy disks 
through the controller 2004 as well as different printer 
arrangements can be employed. 

The secure accounting device 2014 communicates 
with one or more transaction processing centers such 
as 1010. The communications and further interconnec- 
tion with the carrier service, not shown in FIGURE 2, 
are described in FIGURE 1. 

The secure accounting device 2014 also may drive 
the printer 2018 to print the statement of mailing associ- 
ated with each batch of mail generated by the inserter 
system 2002. Alternatively, the printer 2018 may be 
driven by the controller 2004 which is in communication 
with the secure accounting device 2014. The secure 
accounting device 2014 may be associated with a 
number of other inserting systems or mail preparation 
systems which may generate a portion of the batch or 
mail run where job splitting between various equipment 
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is employed. 

Reference is now made to FIGURE 3. The secure 
accounting device 1004 includes a tamper resistant 
housing 3002. Within the tamper resistant housing is a 
central microprocessor 3004 for controlling the opera- 
tion of the secure accounting device 1004. The micro- 
processor and various related microprocessor and/or 
microcontroller devices and systems are suitable for uti- 
lization as part of the secure accounting device 1004. A 
random access memory 3006 wherein mailpiece data 
may be stored is connected to the central microproces- 
sor 3004. Additionally connected to central microproc- 
essor 3004 are non-volatile memories subsystems 
3008 and an encryption engine subsystem 3010. Com- 
munications to the secure accounting device are by way 
of an input/output communications port 3012. The non- 
volatile memory subsystem 3008 includes a non-volatile 
memory 3014 which is controlled by the microprocessor 
via three operational flags. These flags may be imple- 
mented in either separate hardware structure or in 
areas within the non- volatile memory device 3014. A 
write flag 3016, is utilized to enable writing into the non- 
volatile memory 3014 via the central microprocessor 
3004. A store flag 3018 is actuated after a writing oper- 
ation has been completed. The actuation of the store 
flag precludes later modification of data in the non-vola- 
tile memory 3014. Accordingly, data may be written into 
the non-volatile memory 3014 via the write flag 3016 
and may be changed and modified. However, once the 
store flag 3018 is set, modification of this data is pre- 
cluded. Notwithstanding the fact that the data may not 
be modified once the store flag 3018 is set, the data, in 
its entirety, may be erased by actuation of an erase flag 
3020. Thus, data may be written into the memory and 
modified; however, once the store flag is set it may not 
be modified but only erased in its entirety via actuation 
of the erase flag 3020. This provides enhanced security 
since the data can be erased and changed while in 
progress, but once completed it may not be modified. 
The non-volatile memory 3014 also includes a buffer 
area 3019 which allows the temporary buffering of infor- 
mation within the non-volatile memory and is employed 
in a manner which is described in connection with FIG- 
URE 14. 

The encryption engine module 3010 is employed to 
encrypt communications and decrypt communications 
that are transmitted from or are received by the secure 
accounting device 1004 via the I/O communications 
port 3012. The encryption engine 3010 is also utilized to 
generate the digital signature for the statement of mail- 
ing. That is, the statement of mailing is run through a 
hash code function and the resulting output is then 
encrypted using protected encryption keys. 

Reference is now made to FIGURE 4. The batch of 
mail 1020 includes a mailpiece 4002. The mailpiece 
contains addressee information shown generally at 
4004, a postal delivery bar code 4006 and an encrypted 
indicia shown generally at 4008. The encrypted indicia 
including the digital tokens can be formatted in many 



ways depending upon the requirements of the particular 
carrier service involved. Additionally, different informa- 
tion may be included or omitted from the encrypted indi- 
cia depending upon the needs and requirements of the 

5 carrier service. The encrypted indicia 4008 includes a 
secure accounting device identification number repre- 
sented as bar code 4010 shown in alphanumeric repre- 
sentation as PB0000001 at 4012. The indicia 4008 
further includes an imprinted number "353" shown at 

10 4013. The first digit "3" is an error correcting digit and 
the next two digits "5" and "3" are carrier service and 
vendor digital tokens, respectively. It should be specifi- 
cally noted that the digital tokens are digital tokens ini- 
tially generated in connection with mailpiece 2 which 

15 was, for example, spoiled during preparation and has 
been used in collation 7 as will be explained hereinafter. 

One suitable system for verification using two 
encrypted tokens is disclosed in U.S. Patent No. 
5,390,251 for MAIL PROCESSING SYSTEM INCLUD- 

20 ING A CARRIER DATA CENTER VERIFICATION FOR 
MAILPIECES. These digital tokens enable the carrier 
service or the vendor to separately authenticate the 
validity of the encrypted indicia 4008. Moreover, the dig- 
ital tokens can be pre-computed. Reference is made to 

25 European Patent Publication No. 0686946 published 
December 13, 1995 for ADVANCED POSTAGE PAY- 
MENT SYSTEM EMPLOYING PRE-COMPUTED DIG- 
ITAL TOKENS WITH ENHANCED SECURITY, 
assigned to Pitney Bowes Inc. 

30 The encrypted indicia further includes the imprint of 
the postage amount of 58$ for the mailpiece at 4014, 
the date at 4016, the originating postal code at 4018. 
the sequential piece count for the secure accounting 
device "0000002" at 4020. It should be noted that this 

35 sequential piece number is 2 even though the mail col- 
lation is number 7. Thus, the sequential number 2 is 
encrypted into the mailpiece collation 7 as part of the 
vendor and carrier service digital tokens. Bar code at 
4022 is a machine readable representation of piece 

40 count 4020. A return address which may also include 
the originating postal code is shown at 4024. 

Additionally, included on the mailpiece is a state- 
ment of mailing serial number 4026. This statement of 
mailing serial number, here shown for example, as a 

45 single digit "1 uniquely identifies the statement of mail- 
ing which accounts for a given mailpiece on a given day. 
This provides a unique verifiable linkage between the 
physical mailpiece in a batch of mail and the associated 
statement of mailing for the batch. This verification, as 

so will be apparent when the statement of mailing is 
explained, is bi-directional. This means that when the 
mailpiece is inspected it can be uniquely linked to a 
statement of mailing which has been transmitted to the 
carrier service 1012. Correspondingly when a state- 

55 ment of mailing is inspected, it can be uniquely associ- 
ated with a particular mailpiece such as 4002. 

It should be recognized that the information 
described above was in connection with mailpiece infor- 
mation desirably utilized to accomplish the authentica- 
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tion and verification of payment for mail submitted to the 
carrier service. However, additional information may be 
beneficially included on the mailpiece such as the date 
of last inspection of the secure accounting device, a 
request for special services for a given mailpiece, such 
as express mail, a track and trace function and any 
delivery instructions. This may be imprinted on the mail- 
piece as a separate imprint or as a machine readable 
bar code which may be encrypted and may be digitally 
signed. 

It should also be recognized that the physical for- 
matting of the information printed on the mailpiece is a 
matter of choice and may be either imprinted in the 
address block the revenue block, both areas, or in 
some other organization on the mailpiece. 

Reference is now made to FIGURE 5. A printed 
statement of mailing is shown at 5002. The statement of 
mailing is submitted to the carrier service prior to the 
physical submission of the batch of mail 1020. The tim- 
ing of the submission of the statement of mailing and 
the physical mail is important and plays a critical role in 
the acceptance procedure. The statement of mailing 
5002 is provided, as previously explained, by the trans- 
action processing center 1010 and to the carrier service 
1012. Additionally, as previously noted, the statement of 
mailing 2004 can also be provided by the mailer to the 
carrier service 1012 either as a printed document 
and/or electronically on a storage medium. 

The statement of mailing, includes the statement of 
mailing serial number 5004, mailer identification at 
5006, a secure accounting device identification at 5008 
and a mailer account at 5010. Each mailer may have 
several different accounts which are accessed by the 
transaction processing center 1010 for use in different 
applications and each account may have several differ- 
ent secure accounting devices such as 1004 associated 
with it The piece count range is also provided at 5012. 
The range which runs from 0001 through 141 1 is a bro- 
ken range and does not correspond to the total number 
of mailpieces. That is, piece count 3 has not been used 
in the system for the batch of mail. Piece count 2 was 
used; however, it was used in collation 7. Thus, for the 
particular batch of mail there was one non-mailable, for 
example spoiled, mailpiece where the piece count was 
not reused and the digital token associated with the par- 
ticular piece count was not reused. Thus, the total 
number of mailpieces in the batch is one less ("1410 
shown at 5028) than the highest piece count number 
141 1 . Of course, if the piece count range does not start 
at 1 other adjustments would be reflected between the 
piece count number, piece count gaps and the total 
number of mailpieces. This is all verifiable by the carrier 
service. Thus, if a mailpiece including piece count 3 
were to appear in the batch of mail, the postal service 
would institute further investigation to determine the 
reason for such discrepancy since it would be an indica- 
tion of improper activity. Also provided as part of the 
statement of mailing is the date of submission at 5014 
and the identification of the rating table employed at 



5016. The rating table identification may be a truncated 
encrypted hash code of the rating table employed in a 
manner described in the above noted patent, U.S. Pat- 
ent No. 5,448,641 for POSTAL RATING SYSTEM WITH 

5 VERIFIABLE INTEGRITY. The address and postal code 
of the accepting post office is provided at 5017. 

A digital signature of the entire statement of mail- 
ing, is provided at 5018 and an error control code at 
5020 to facilitate error detection and correction when 

w machine reading the statement of mailing. This control 
code is particularly useful H the statement of mailing is 
printed and physically presented to the postal service or 
carrier service 1012. 

The statement of mailing further contains informa- 

15 tion for groups of mailpieces which are similar in weight, 
size, discount and carrier payment or postage. For 
example, on line 1 at 5022, 731 pieces with postage of 
32<t, the full postage rate of the standard size US mail- 
piece and with the actual weight of 5/10 of an ounce are 

20 listed. Similarly, in the following entries various groups 
of mailpieces having similar weight, size, discount and 
postage are listed. The various totals, such as the total 
weight of the mailpieces in the batch are provided at 
5024 along with the total postage at 5026 and the total 

25 number of mailpieces at 5028. 

The organization and content of the statement of 
mailing 5002 is a matter of preference depending on the 
needs of the mailer, carrier and transaction processing 
center. 

30 Reference is now made to FIGURE 6. A list of col- 
lations in process (LCP) 6002 includes a list of the first 
six collations (mailpieces) which were accounted for in 
the secure statement of mailing stored in the secure 
accounting device 1004. Collations 5 and 6 are not 

35 shown. The last three collations, 6006 are at a stage 
when the indicia information request to the secure 
accounting device 1004 are still in the queue. When 
some of the collations, for example, collation number 2 
and collation number 3 designated by 6008 and 6010; 

40 respectively, cannot be finished due to some malfunc- 
tion, the inserter controller places these collations indi- 
cia information on a second list of indicias available for 
reuse (IAR) shown in FIGURE 7. As will be noted in 
connection with FIGURE 6, various information is 

45 included regarding each of the collations including the 
collation number at 6012, rating information at 60 14 and 
indicia variable information at 6016. Referring to one 
specific collation in its entirety, collation 2 designated by 
6008 includes the collation number 2, the weight of 1.7 

so ounces, standard size, and first class service. The piece 
count is designated as 0000002, the scan error correc- 
tion code as 367 with a postal token "5". a vendor token 
"3" and a postage amount of 58$. Similar types of infor- 
mation is provided for each collation. 

55 Reference is now made to FIGURE 7. This list of 
indicias available for reuse (IAR) includes the indicias 
associated with collations 2 and 3. (6008 and 6010 
respectively). This includes the information previously 
noted in connection with FIGURE 6, however, a sequen- 
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tial number of indicias available for reuse is also 
included at 7004. 

Reference is now made to FIGURE 8 which is a list 
of completed indicias (LCI). This is a list of fully assem- 
bled and finished mailpieces with printed and accounted 
for indicias. As soon as the inserter controller recog- 
nizes, or is notified regarding, the problems with colla- 
tions 2 and 3, specifically collations designated at 6008 
and 6010, the inserter controller 2004, or other suitable 
processing system for other type of mail preparation 
equipment, searches the list of collations in process, 
which have a request for indicias in the queue in order 
to find possibilities for reusing indicia information 
already received for collation 2 and collation 3. In this 
search, the deciding compatibility factor is the identity of 
rating parameters, and, typically and often most impor- 
tantly, the weight. For example, collation number 7 
shown in FIGURE 6 has the same rating parameters as 
non-mailabie, for example spoiled, collation number 2 
6008 (with sequential IAR # "1" as shown in FIGURE 7). 
Therefore the indicia information for collation number 2 
can be reused for collation number 7. 

The inserter controller 2004 shown in FIGURE 2 
then removes the indicia number 1 from the list of indi- 
cias available for reuse and places it into the first list in 
position number 7 as shown in FIGURE 9. This is an 
operation of the indicia transplantation or reuse where 
the indicia or digit token originally intended for non-mail- 
able or not prepared collation 2 is taken from the list of 
indicias available for reuse and utilized with collation 
number 7. The list of collations in process after reuse of 
indicia number 2 is shown in FIGURE 9. Collation 
number 7 includes the digital token associated with orig- 
inal collation 2 and the piece count associated with col- 
lation 2. Thus, the piece count sequence for the various 
collations is no longer in order in the physical mail 
stream. 

As will be apparent from FIGURE 10, the list of indi- 
cias available for reuse after reuse of indicia 2 includes 
only one indicia token shown for piece count 0000003. 
When the inserter controller 2004 receives a signal that 
a mailpiece has been fully assembled and finished 
including printing of the indicia, then the list of collations 
in process and the list of completed indicias are updated 
by removing the indicia information from the former list 
and placing H on the latter one. For example, after colla- 
tion number 7 has been successfully finished, the list of 
collations in process and completed indicias are as 
shown in FIGS. 11 and 12, respectively. It can be seen 
in FIGURE 11, that collation 8, at 1104 and collation 9, 
at 1 106 are presently in the process of completion, col- 
lation 7 having been completed. As can be seen in FIG- 
URE 12, completed indicia 1 for collation number 1 
utilizes piece count 1 as shown at 1204. Completed 
indicia 2 associated with collation 4 utilizes piece count 
4 as shown at 1206. Completed indicia 5 associated 
with collation 7 employs piece count 2 as shown at 
1208. This shows the sequence of indicias that were 
completed on the mailpieces as the process continues. 



Since mailpieces 2 and 3, that is collations 2 and 3, 
were spoiled in process (or not generated) and only the 
digital token from collation 2 was reutilized, piece count 
3 is missing from the sequence of completed indicias 

5 and remains as a indicia available for reuse shown in 
FIGURE 10. If desired as part of the information 
retained in FIGURE 12, an associated collation can be 
included with the completed indicia number. This would 
assist the mailer if the destroyed pieces are retained 

10 and any information is available from them to verify the 
processes proceeding appropriately. 

Reference is now made to FIGURE 13. The inserter 
controller process commences at 1302. The next colla- 
tion is obtained at 1304 and a determination is then 

15 made at 1306 if this is the last collation. If it is the last 
collation, the process ends at 1308. If it is not the last 
collation, postal rating parameters for the collation from 
sensors and other and/or key entry information is 
obtained and postal rating is computed at 1310. The 

20 indicias available for use in matching postal rating 
parameters are then scanned at 1312. If a match is 
found at 1314 of indicias available for reuse, indicia 
information from the list of indicias available for reuse is 
moved to the list of collations in process at 1316. A com- 

25 mand is sent to the printer to cause the printer to print 
the indicia at 1318. A determination is then made at 
1320 of whether the collation is completed and properly 
printed. If this is the case, at 1 322 the indicia information 
is removed from the list of collations in process and 

30 placed on the list of completed indicias. The system 
then loops back to get the next collation number. If on 
the other hand the collation completion does not occur 
at 1320, the indicia is then again placed on the list of 
indicias available for reuse at 1324 and the system 

35 loops back to get the next collation at 1304. 

If after step 1312, no match is found at 1314 for an 
indicia available for reuse, the postal rating parameters 
are sent to the secure accounting device at 1326. Indi- 
cia information is received from the secure accounting 

40 device and is placed on the list of collations in process 
at 1328. The system then loops back to proceed with 
sending a print command to the printer controller to print 
the indicia at 1318. 

Reference is now made to FIGURE 14. The proc- 

45 ess starts at 1402. The present collation number is 
obtained from the inserter controller and the rating 
parameters are received for the present collation from 
the inserter controller at 1404. The indicia information 
for the present collation is then computed at 1406. A 

so write flag is set up and indicia information is written into 
the buffer at 1408. A collation completion signal from the 
inserter controller is received at 1410. At this time a 
determination is made of whether the mailpiece is com- 
pleted and whether it will be mailed at 1412. If this is the 

55 case, the Store Flag is set at 141 4 and the indicia infor- 
mation is stored and updated in the statement of mail- 
ing. If, on the other hand, the mailpiece has not been 
completed and will not be mailed the system loops back 
to step 1404. A determination is made at 1416 of 
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whether this is the last collation. If it is not, the system 
loops back to step 1 404. 

If it is the last collation, the Erase Flag is set up and 
the information stored concerning indicias in process is 
erased from the buffer. 

It should be expressly noted that the indicias 
erased from the buffer may be used by unscrupulous 
mailers to create unpaid mailpieces with faked indicias. 
In this case such a mailer might obtain sequential piece 
counts of unused indicias stored in the buffer and would 
imprint mailpieces with piece counts and corresponding 
real or counterfeited digital tokens. Then after a discrep- 
ancy between actual and reported weight of a batch is 
discovered during the acceptance procedure, finding 
evidence of fraud would be more difficult compared to a 
manual inspection of piece counts in the batch and may 
require a scanning of a sample of mailpieces. 

In order to avoid this complication, the system can 
be configured to store an ordered list of unused piece 
counts, digital tokens or other useful information in the 
statement of mailing before erasing the buffer. In this 
case, a manual inspection of a sample of mailpieces 
can be done against the statement of mailing just based 
on printed piece counts, digital tokens or other useful 
information. Thus, an inspector, for example, may sim- 
ply check every mailpiece in the batch in order to deter- 
mine whether a piece count in the indicia is outside of 
the range reported in the statement of mailing and 
whether it is a duplicate piece count already encoun- 
tered in the sample. This avoids the considerable cost of 
scanning mailpieces in order to obtain evidence of 
fraud. If this system is implemented the operation 
shown in FIGURE 14 would contain an additional proc- 
ess block before the block 1418 storing an ordered list 
of unused piece counts in the NVM and in the statement 
of mailing before computing the digital signature and 
releasing the statement of mailing file. 

The digital signatures for the statement of mailing 
file are computed and the signed statement of mailing is 
released to the inserter controller and transmitted to the 
transaction processing center and to the Post Office 
operations as shown and described in Figure 1 . There- 
after the process ends at 1420. 

While the present invention has been disclosed and 
described with reference to the disclosed embodiments 
thereof, it will be apparent, as noted above, that varia- 
tions and modifications may be made. For example, the 
mailer's computer, which contains mailing address lists, 
can perform address cleansing and send the address 
list to the inserter in a mail run data file. This file would 
contain control information for matching the control doc- 
uments with the corresponding envelopes. This can be 
done employing, as previously noted, digital tokens 
which utilize addressee information or do not utilize 
addressee information. It is, thus, intended in the follow- 
ing claims to cover each variation and modification that 
falls within the true spirit and scope of the present inven- 
tion. 



Claims 

1 . A method for mail payment evidencing, comprising: 

5 processing a collation of mail where said colla- 

tion is one of a series of mail collations being 
created; 

determining if a previously generated digital 
token associated with a previous mail collation 

w which was not completed is suitable for use on 

said mail collation in process; and, 
utilizing said previously generated digital token 
for said mail collation in process if said previ- 
ously generated digital token is suitable for use 

15 on said mail collation in process. 

2. A method for mail payment evidencing as defined in 
claim 1 including determining payment rating 
parameters for carrier services to be associated 

20 with said mail collation in process and wherein said 
determining if a previously generated digital token 
associated with a previously collation which was not 
completed is suitable for use on said mail collation 
is based on the similarity of at least one rating 

25 parameter of the carrier service between said previ- 
ous mail collation which was not completed and 
said mail collation in process. 

3. A method for mail payment evidencing as defined in 
30 claim 2 wherein said determining if a previously 

generated digital token associated with a previously 
collation which was not completed is suitable for 
use on said mail collation is based on said at least 
one rating parameter of the carrier service between 
35 said previous mail collation which was not com- 
pleted and said mail collation in process being the 
same. 

4. A method for mail payment evidencing as defined in 
40 claim 2 or 3 wherein one said rating parameter is 

the anticipated weight of said previous mail colla- 
tion which was not completed and of said mail col- 
lation in process. 

45 5. A method for mail payment evidencing as defined in 
any one of claims 2 to 4 wherein said determining if 
a previously generated digital token associated with 
a previously collation which was not completed is 
suitable for use on said mail collation is based on 

so the similarity of more than one rating parameter 
carrier service between said previous mail collation 
which was not completed and said mail collation in 
process. 

55 6. A method for mail payment evidencing as defined in 
claim 5 wherein said rating parameters include 
anticipated special handling carrier services for 
said previous mail collation which was not com- 
pleted and said mail collation in process. 
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7. A method for mail payment evidencing as defined in 
any one of claims 1 to 6 wherein said determining if 
a previously generated digital token associated with 
a previously collation which was not completed is 
suitable for use on said mail collation is based on all 
of the rating parameters for carrier service for said 
previous mail collation which was not completed 
and said mail collation in process being the same. 

8. A method for mail payment evidencing as defined in 
any one of the preceding claims including maintain- 
ing a list of previously generated digital token asso- 
ciated with a previous mail collations which were 
not completed. 

9. A method for mai I payment evidenci ng as defined i n 
claim 8 wherein said digital tokens are generated 
without addressee information. 

10. A method for mail payment evidencing as defined in 
any one of the preceding claims including generat- 
ing a statement of mailing for the created mail colla- 
tions to be submitted to the carrier service, said 
statement of mailing including data concerning 
generated digital tokens not utilized in said series of 
completed mail collations. 

1 1 . A method for mail payment evidencing as defined in 
claim 10 wherein said statement of mailing data 
concerning generated digital tokens not utilized in 
said series of completed mail collations is piece 
count data. 

12. A method for mail payment evidencing as defined in 
any one of the preceding claims further comprising 
generating a statement of mailing without an error 
documentation file to account and reconcile for the 
issuance of said previously generated digital token 
utilized in said series of completed mail collations. 

1 3. A method for mail payment evidencing as defined in 
any one of the preceding claims including digitally 
signing said statement of mailing. 

14. A method for mail payment evidencing as defined in 
claim 13 further including digitally signing said 
statement of mailing prior to submission of said 
completed collations to said carrier service. 

15. A system for mail payment evidencing system, 
comprising: 

means (1002) for processing a collation of mail 
where said collation is one of a series of mail 
collations being created; 
means for determining if a previously gener- 
ated digital token associated with a previous 
mail collation which was not completed is suit- 
able for use on said mail collation in process; 
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and, 

means for utilizing said previously generated 
digital token for said mail collation in process if 
said previously generated digital token is suita- 
s ble for use on said mail collation in process. 

16. A system for mail payment evidencing as defined in 
claim 15 including means for determining payment 
rating parameters for carrier services to be associ- 

10 ated with said mail collation in process and wherein 
said means for determining if a previously gener- 
ated digital token associated with a previous colla- 
tion which was not completed is suitable for use on 
said mail collation is arranged to operate based on 

15 the similarity of at least one rating parameter of the 
carrier service between said previous mail collation 
which was not completed and said mail collation in 
process. 

20 17. A system for mail payment evidencing as defined in 
claim 16 wherein said means for determining if a 
previously generated digital token associated with a 
previous collation which was not completed is suit- 
able for use on said mail collation is arranged to 

25 operate based on said at least one rating parameter 
of the carrier service between said previous mail 
collation which was not completed and said mail 
collation in process being the same. 

30 1 8. A method for mail payment evidencing as defined in 
claim 17 wherein said one rating parameter is the 
anticipated weight of said previous mail collation 
which was not completed and of said mail collation 
in process. 

35 

1 9. A system for mail payment evidencing as defined in 
any one of claims 16 to 18 wherein said means for 
determining if a previously generated digital token 
associated with a previous collation which was not 

40 completed is suitable for use on said mail collation 
is arranged to operate based on the similarity of 
more than one rating parameter carrier service 
between said previous mail collation which was not 
completed and said mail collation in process. 

45 

20. A system for mail payment evidencing as defined in 
any one of claims 16 to 19 wherein said means for 
determining if a previously generated digital token 
associated with a previous collation which was not 

so completed is suitable for use on said mail collation 
is arranged to operate based on all of the rating 
parameters for carrier service for said previous mail 
collation which was not completed and said mail 
collation in process being the same. 

55 
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